Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform The vulnerabilities allow low-privileged users to abuse higher user privileges, which can lead to unauthorized actions and access to sensitive information. This can occur through phishing attacks and Cross-Site Request...

PT-2025-13298 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential null pointer dereference issue has been identified in the Linux kernel, specifically in the sp usb phy probe function. This function calls platform get resource byname, whi...

Amazon Linux 2 : kernel (ALAS-2025-2790)

The version of kernel installed on the remote host is prior to 4.14.290-217.505. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2790 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality in the...

CVE-2025-20230 Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value...

CVE-2025-20228

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store KVStore through a...

Security Bulletin: Financial Transaction Manager for Digital Payments, High Value Payments and Corporate Payment Services are impacted by multiple vulnerabilities.

Summary The vulnerabilities addressed include access control, sensitive information disclosure, cross site scripting and directory traversal. Vulnerability Details CVEID:CVE-2020-5002 DESCRIPTION: IBM Financial Transaction Manager could allow an authenticated user to perform unauthorized actions...

kernel: ipv4: Fix uninit-value access in __ip_make_skb()

A flaw was found in the Linux kernel's IPv4 networking subsystem. A local user can cause a Denial of Service DoS by exploiting a race condition when altering socket options while network packets are being constructed. This issue leads to an uninitialized memory read that can crash the system...

CVE-2025-20228: Cross-Site Request Forgery (CSRF)

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store KVStore through a...

ROS-20250326-10

A vulnerability in the Nextcloud calendar cloud software application for creating and utilizing a Nextcloud data warehouse is related to the failure to clean up line breaks and special characters in the email value in a JSON request. Exploitation of the vulnerability could allow an attacker actin...

Splunk Access Control Vulnerability

Splunk is a suite of data collection and analysis software from Splunk, Inc. It is used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk suffers from an Access Control Error...

Splunk Cloud Platform and Splunk Enterprise have vulnerabilities related to cross-site request forgeing attacks.

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. A cross-site request forgery vulnerability...

PT-2025-18452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue has been found in the Linux kernel where the user can set any speed value. If the speed is greater than UINT MAX/8, it is possible to cause a division by zero. This issue was...

PT-2025-18447

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero issue has been resolved in the Linux kernel. The problem occurs when a user sets a speed value greater than UINT MAX/8, making division by zero possible. This issue wa...

PT-2025-18449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue has been found in the Linux kernel where the user can set any speed value. If the speed is greater than UINT MAX/8, it is possible to cause a division by zero. This issue was...

PT-2025-18451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero issue has been resolved in the Linux kernel. The problem occurs when a user sets a speed value greater than UINT MAX/8, making division by zero possible. This issue wa...

harfbuzz:hb-draw-fuzzer: Use-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_path_t, cff2_path_param_t, CFF::number_t, cff

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5647032962580480 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Linux AMD Display Clock Manager Buffer Overflow DoS

The vulnerability of the dcn3clkmgrconstruct function in the drivers/gpu/drm/amd/display/dc/clkmgr/dcn30/dcn30clkmgr.c module of the Linux operating system is related to the lack of checking for the return value. Exploiting this vulnerability may allow an attacker to cause a service failure...

PT-2025-18441

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue was related to the handling of Out-of-Memory OOM conditions during VMA merge operations. In certain cases, the caller did...

CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...

CVE-2024-11302

A missing checkaccess function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized...